### Author:  [@vimal\_P](https://discuss.elastic.co/u/vimal_P)
#### Post date: [April 2, 2018, 6:30pm UTC](https://discuss.elastic.co/t/file-path-directory-name-extract-regex/126455/1 "2018-04-02T18:30:45Z")
Hi Everyone,
I need to extract directory name from the "path" field and assign it to "arcot" field. I require "arcot" value for filtering purpose. Below is the code i am using. path variable is storing "D:\Program Files (x86)\Arcot Systems1\logs\arcotriskfort.log" i am extracting "Arcot Systems1" into variable "arcot" and getting below error,
Please note: I am a beginner in ELK
Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, ,, ] at line 18, column 17
```
input
{
file
{
path => ["D:\Program Files (x86)\Arcot Systems1\logs\arcotriskfort.log"]
start_position => "beginning"
}
}
filter
{
grok
{
match => ["message","%{SYSLOGTIMESTAMP:timestamp} %{NUMBER:year} %{LOGLEVEL:level}%{GREEDYDATA}RT=%{NUMBER:RT},Q1T=%{NUMBER:Q1T},PT=%{NUMBER:PT},PPT=%{NUMBER:PPT},APT=%{NUMBER:APT},MT=%{NUMBER:MT},Q2T=%{NUMBER:Q2T},DT=%{NUMBER:DT}"]
match => ["path","\\[^\\]+\\\\(?[^\\]+)\\"]
}
mutate
{
convert => { "DT" => "integer" }
convert => { "Q1T" => "integer" }
convert => { "APT" => "integer" }
convert => { "RT" => "integer" }
}
}
output
{
stdout { codec => rubydebug }
elasticsearch
{
#host => "localhost"
#protocol => "http"
#cluster => "elasticsearch"
index => "newfrm"
template => "D:\Program Files (x86)\abc.txt"
template_name => "newfrm"
template_overwrite => true
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 2, 2018, 6:53pm UTC](https://discuss.elastic.co/t/file-path-directory-name-extract-regex/126455/2 "2018-04-02T18:53:01Z")
> [@vimal\_P](#):
>
> ```auto
> match => ["path","\\[^\\]+\\\\(?<arcot>[^\\]+)\\"]
>
> ```
The escaping is wrong, so it thinks there is no closing " in that pattern, and it blows up when it gets to "DT".
---
### Author:  [@vimal\_P](https://discuss.elastic.co/u/vimal_P)
#### Post date: [April 2, 2018, 8:24pm UTC](https://discuss.elastic.co/t/file-path-directory-name-extract-regex/126455/3 "2018-04-02T20:24:21Z")
Thank you @Badger, its looking for an unclosed quote, So simply appending an extra quote is resolving the error, but pattern is not doing its job.
If its ok can you/anyone suggest correct pattern. I am stuck at this since a long time.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 2, 2018, 8:39pm UTC](https://discuss.elastic.co/t/file-path-directory-name-extract-regex/126455/4 "2018-04-02T20:39:02Z")
I will let someone else try to find a pattern that will grok. I would do this using dissect.
```auto
dissect { mapping => { "path" => "%{}\%{}\%{arcot}\%{}" } }
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 30, 2018, 8:39pm UTC](https://discuss.elastic.co/t/file-path-directory-name-extract-regex/126455/5 "2018-04-30T20:39:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.